Anthropic’s unreleased Claude Mythos Preview model has triggered urgent cybersecurity reviews across India’s government, banking, and IT sectors after the AI system autonomously uncovered thousands of previously unknown vulnerabilities in critical open-source infrastructure. The discovery has forced India to confront a stark reality: the same AI capabilities that could strengthen national defense could also empower adversaries to breach India’s digital backbone within hours.
What Mythos Found
Announced on April 7, 2026, Mythos Preview demonstrated unprecedented autonomous vulnerability discovery, identifying:
Critically, Mythos didn’t just find these bugs—it wrote complete working exploits without human guidance, including chaining multiple vulnerabilities together. Anthropic’s red team confirmed the model can exploit zero-day vulnerabilities across every major operating system and reverse-engineer exploits for closed-source software.
India’s Structural Exposure
India’s digital infrastructure faces disproportionate risk because its core systems run on the same open-source software Mythos is scanning:
- UPI transactions powering India’s $1 trillion digital payments ecosystem
- Aadhaar verifications at ration shops serving 1.4 billion citizens
- IRCTC tatkal bookings handling millions of railway reservations daily
“As the Siasat Daily noted, every critical Indian platform runs on layers of the same open-source software that Mythos is now scanning”. Legacy public platforms like Aadhaar and GST face “elevated exposure, particularly where uneven security standards persist”.
Banks and Industry Sound the Alarm
HDFC Bank, India’s largest private-sector lender, confirmed direct engagement with Anthropic: “We are engaged with the Data Security Council of India to evaluate risks and impact. We can confirm being in touch with the Anthropic team”. The Data Security Council of India has begun industry-wide consultations, while SaaS and deep-tech firms assess heightened risks extending into SCADA and IoT infrastructure.
The urgency isn’t limited to India. U.S. Treasury Secretary Scott Bessent convened emergency meetings with CEOs of Bank of America, Citi, and Wells Fargo. Government officials in the United States, Canada, and Britain have all met with banking leaders to discuss Mythos-induced threats.
Global Response: Project Glasswing
Anthropic launched Project Glasswing on April 7, assembling Amazon Web Services, Apple, Google, Microsoft, NVIDIA, Cisco, CrowdStrike, JPMorganChase, the Linux Foundation, and Palo Alto Networks to “secure the world’s most critical software”. The initiative includes:
- $100 million in usage credits for Mythos Preview
- $4 million in donations to open-source security bodies
- Defensive AI for vulnerability detection and penetration testing
No Indian firm has been included in the initial consortium despite India being one of Anthropic’s largest markets.
What This Means for India’s IT Sector
Analysts at Motilal Oswal warn that while disruption to India’s $260 billion IT services sector may not be immediate, the pressure to evolve is intensifying as AI compresses vulnerability discovery from months to hours. Kotak Institutional Equities flagged disruption risks to the sector’s growth trajectory.
The situation creates a paradox: India depends on American-built AI models for national security audits while facing exclusion from the very coalition designed to address these risks. Experts are calling for India to:
- Formally seek inclusion in Project Glasswing
- Accelerate indigenous AI-driven cybersecurity tool development
- Implement Zero Trust architecture immediately
As Newton Cheng, Anthropic’s Frontier Red Team Cyber Lead, warned: “We do not plan to make Claude Mythos Preview generally available… However, given the rate of AI progress, it will not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely”.
For India, the message is clear: the window to prepare is closing rapidly. Without indigenous AI security capabilities and formal participation in global cybersecurity initiatives, the country’s digital sovereignty faces unprecedented risk from AI-driven cyber threats.